Free randomness can be amplified 



Roger Colbeck^'j^] and Renato Renner^'j^ 

'Perimeter Institute for Theoretical Physics, 31 Caroline Street North, Waterloo, ON N2L 2Y5, Canada. 
^Institute for Theoretical Physics, ETH Zurich, 8093 Zurich, Switzerland. 
(Dated: 17th November 2011) 

Are there fundamentally random processes in nature? Theoretical predictions, confirmed experi- 
mentally, such as the violation of Bell inequalities, point to an affirmative answer. However, these 
results are based on the assumption that measurement settings can be chosen freely at random, so 
assume the existence of perfectly free random processes from the outset. Here we consider a scenario 
in which this assumption is weakened and show that partially free random bits can be amplified to 
make arbitrarily free ones. More precisely, given a source of random bits whose correlation with 
other variables is below a certain threshold, we propose a procedure for generating fresh random 
bits that are virtually uncorrelated with all other variables. We also conjecture that such procedures 
exist for any non-trivial threshold. Our result is based solely on the no-signalling principle, which 
is necessary for the existence of free randomness. 



I. INTRODUCTION 

Physical theories enable us to make predictions. We 
can ask "what would happen if..." and reason about the 
answer, even in scenarios that would be virtually impossi- 
ble to set up in reality IJ . Each scenario corresponds to a 
choice of parameters, and it is usually implicitly assumed 
that any of the possible choices can be made — the theory 
prescribes the subsequent behaviour in every case. One 
of the main aims of this paper is to identify (minimal) 
conditions under which such choices can be made freely, 
i.e., such that they are uncorrelated with any pre-existing 
values (in a precise sense described later). 

The ability to make free choices is important to estab- 
lish symmetries, on which physical theories can be based. 
For example, the concept of an electron is based on the 
implicit assumption that we could pick any of the elec- 
trons in the universe and find the same properties (such 
as its mass). More precisely, given a set of particles 
that are experimentally indistinguishable, the assump- 
tion that we can sample freely from this set establishes 
a symmetry between them. Following arguments by de 
Finetti [21 [3] , this symmetry implies that we can treat 
these particles as independent particles of the same type. 

A scenario in which making free random choices is 
particularly relevant is in the context of Bell's theorem. 
Here, the distribution arising from measurements, cho- 
sen freely from a given set, on an entangled state is used 
to conclude that quantum correlations cannot be repro- 
duced by a local hidden variable theory [U |4]. Drop- 
ping the assumption that the measurement settings are 
freely chosen opens a loophole, rendering the conclusion 
invalid. In particular, if one instead imagines that the 
settings were determined by events in the past, then it 
is easy to explain Bell inequality violations with a local 
classical model. However, one can ask whether the free 
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choice assumption can be relaxed, allowing for correla- 
tions between the measurement settings and other, pos- 
sibly hidden, variables, but without allowing their com- 
plete pre-determination. This has been studied in recent 
work [MS] which shows that if the choice of measurement 
settings is not sufficiently free then particular quantum 
correlations can be explained with a local classical model. 

This raises the question of whether established con- 
cepts in physics are rendered invalid if one relaxes the 
(standard) assumption that the experimenters' choices 
are perfectly free. One might imagine, for example, an 
experimenter who tries to generate free uniform bits, but 
(unbeknown to them) these bits can be correctly guessed 
with a probability of success greater than 1/2 using other 
(pre-existing) parameters. In this paper, we show that 
partially free random bits can be used to produce arbi- 
trarily free ones. This implies that a relaxed free choice 
assumption is sufficient to establish all results derived 
under the assumption of virtually perfect free choices. 

To arrive at this conclusion we need to make one as- 
sumption about the structure of any underlying physical 
theory, namely that it is no-signalling, which essentially 
implies that local parameters are sufficient to make any 
possible predictions within the theory. As we explain in 
Appendix [Cj it turns out that this assumption is neces- 
sary in order that perfectly free choices can be consis- 
tently incorporated within the theory. 

II. PRELIMINARIES 

In order to describe our result in detail, we need a pre- 
cise notion of what partially free randomness means. Our 
notion is based on Bell's [T] , and we formulate it in terms 
of spacetime variables (SVs) '10], which means that each 
variable is associated with a spacetime coordinate. This 
coordinate is to be interpreted as the location in space- 
time at which the random variable is available. (We can 
also treat random variables that are available within a re- 
gion of spacetime by defining a set of SVs that are copies 
of the original random variable with different spacetime 
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coordinates.) 

For a particular SV, X, we say that X is perfectly free 
(with respect to a set of SVs T) if it is uniformly dis- 
tributed and uncorrelated with all SVs in Tx , the subset 
of SVs from F that lie outside the future lightcone of X. 
This definition captures the idea that X is free if there is 
no reference frame in which it is correlated with variables 
in its past. Note that it also includes that X is uniformly 
distributed. While, in other contexts, it may be useful 
to separate these concepts, in the present work such a 
distinction is not needed. 

We also need a notion of partial freedom. We say that 
X is e-free (with respect toT) if it is e-close (in variational 
distance) to being perfectly free, i.e. if 
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where Px denotes the uniform distribution on X. We 
use the variational distance, defined by D{Px,Qx) '■— 
\ \Px(x) — Qx{x)\, as our measure of closeness. It 
is chosen because of its operational significance: if two 
distributions have variational distance at most e, then 
the probability that we ever notice a difference between 
them is at most e. (A note on notation: we use lower 
case to denote particular instances of upper case SVs.) 
As an example, if a uniformly random bit X is correlated 
to a pre-existing bit W such that Px\w=o{^) = | and 
Px\w=i{^) — f then we say that X is e-free (with respect 
to {W}) for £ = i. 

We remark that a sequence of bits Xi , X2 ■ ■ ■ for which 
each bit Xi is £-free with respect to the previous ones is 
known in classical computer science as a Santha-Vazirani 
source [TT] . 



III. MAIN RESULTS 

The idea of the present work is to exploit a particu- 
lar set of non-local correlations found in quantum theory 
that can be quantified using the chained Bell inequali- 
ties [121 US]- If we have perfect free randomness to choose 
measurements, then the violation of a Bell inequality in- 
dicates that the measurement outcomes cannot be com- 
pletely pre-determined [1]. Bell's arguments have re- 
cently been extended to show that, again under the as- 
sumption that we have perfect free randomness, there is 
no way to improve on the predictions quantum theory 
makes about measurement outcomes [TUj. Here, we show 
that quantum correlations can be so strong that, even if 
we cannot choose the measurements perfectly freely, the 
outputs are nevertheless perfectly free. 

To generate these correlations, we consider an exper- 
imental setup where local measurements are performed 
on a pair of maximally entangled qubits (see Figure [T]). 
We first make the (temporary) assumption that quan- 
tum theory is correct, in the sense that the joint dis- 
tribution of measurement outcomes is the one predicted 
by quantum theory for this setup. Crucially, however 



we do not require completeness of quantum theory, i.e., 
that quantum theory is maximally informative about the 
measurement outcomes (for further discussion on the dis- 
tinction between correctness and completeness, see Ap- 
pendix |A|. Instead, we consider arbitrary additional pa- 
rameters, modelled as a set of SVs, W , which may be 
provided by a higher theory. (Note that W can include 
measurement choices and outcomes of other systems that 
may not be classical.) Our first main result is the follow- 
ing theorem. 

Theorem For e < sa 0.086, < e' < £ and 

any (set of) SVs W, assuming correctness of quantum 
theory, there exists a protocol that uses £-free bits with 
respect to W to generate £'-free bits with respect to W. 

The proof relies on a bipartite setup (see Figure [T]) . 
It is parameterized by an integer, N, corresponding to 
the number of measurement settings on each side. The 
SVs Ae {0,2,...,2N -2} and B e {1, 3, . . . , 2iV - 1} 
correspond to measurement settings and X £ {-fl,— 1} 
and Y S {-1-1,— 1} are their respective outcomes. The 
measurements are made in such a way that the processes 
A X and B Y (this notation is defined precisely 
in Appendix |b]) are spacelike separated, and the entire 
process generates a probability distribution Pxy\ab- We 
introduce a measure of the strength of correlations by 
defining 

In ■■=P{X = Y\ao,bo)+Y^ P{X^Y\a,b), (2) 



where oq = and bo = 2N - 1 and P{X ^ Y\a,b) 
is the probability that the measurements had different 
outcomes for settings A = a, B = b. This quantity 
was originally introduced to study chained Bell correla- 
tions [m [13] , and has found use in cryptography [TH [T3] 
and quantum foundations jlOl I16j . It turns out that all 
classical correlations satisfy /at > 1, while quantum cor- 
relations exist for which 
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which tends to in the limit of large N (the state and 
measurements required to achieve this can be found in 
Appendix |f]) . 

In the proof of Theorem 1, we use the following lemma 
about no-signalling distributions. A bipartite condi- 
tional distribution Pxy\ab is said to be no-signalling if 
Px\AB = Px\A and Py\ab = Py\b (a criterion which 
is readily generalized to more parties). The lemma then 
bounds the freedom of the output bits with respect to 
{A, B} U in terms of the strength of quantum correla- 
tions, quantified using /^v, and how free the measurement 
settings are, quantified via 



qNia,b) := 
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Pw\ab{w') 



Lemma 1 — If Pxy\abw is no-signalling for all w, and 
qN{a, b) > 0, then 



DiPxWlab, Px X Pw\ab) < „ f . . (4) 

2qN{a,b) 

for all a and b, where Px denotes the vmiform distribution 
on X. 

The proof of this lemma is given in Appendix [E] 

Proof of Theorem 1 — For N = T' , the measurement set- 
tings, A and B can be picked using r bits from the im- 
perfect sources. Note that 



qN{,a,b) 



mm 

:i' M .xu' 
i'-6'| = l 



P. 



{a',b') 
PAB\w'{a-b) 



AB\w' 



in the case of uniform Pab , which we can assume without 
loss of generality. For the sources described above, we 

have 92'- (a, b) > ( j . Inserting this into Q gives 



D{PxW\ab,Px X Pw\ab) < 



l + 2e 
1 - 2e 



Substituting the value of obtainable in quantum 
theory (see Eq. (Is])) gives 
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2r 



D{PxW\ab, Px X Pw\ab) < 2'' ( 1 Siu^ 



Hence, using the bound sin a; < x for x > 0, it follows 
that 
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which tends to as r tends to infinity provided e < 

^'^""'"^ . Therefore, if the initial sources are £-free, for 
such e, then their outputs are arbitrarily free with re- 
spect to {A, B} UW (and hence, in particular, with re- 
spect toW). □ 

It is natural to ask whether the assumption made 
above, that quantum theory correctly predicts the cor- 
relations, is necessary, or whether, instead, the presence 
of sufficiently strong correlations can be certified using 
e-free bits. This is also relevant in a cryptographic con- 
text, where the states and measurements are not trusted, 
and could have been chosen by an adversary with partial 
knowledge of the measurement settings (modelled by a 
set of SVs, W). 

Theorem 2 — For e < 0.0158, < e' < £ and any (set of) 
SVs W, there exists a protocol that uses e-free bits with 
respect to W to certify the generation of e'-free bits with 
respect to W. 

Certification means that the protocol involves a test 
of the correlations that is essentially impossible to pass 
unless the generated bits are e'-free. However, the test is 
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FIG. 1: Illustration of the bipartite setup. Spacelike sep- 
arated measurements are carried out using devices denoted D. 
The measurement settings, A and B are derived from bits gen- 
erated by two sources, denoted S. These bits are only partially 
free, i.e., they may be correlated (represented by the dashed 
line) with each other and with some other variables W (to be 
interpreted as parameters provided by a higher theory), which 
may also influence the supply of states being measured. By 
exploiting correlations between the outcomes X and Y, we 
show that, in spite of the lack of free randomness to choose 
settings, the outcome X is arbitrarily close to being uniform 
and uncorrelated with W. 



passed if quantum theory is correct. The proof of The- 
orem 2 is given in Appendix [Fj where we describe and 
analyse a protocol that achieves this task. 

Theorem 2 implies that there exists a device- 
independent protocol for free randomness amplification. 
Clearly this second scenario, where the assumption of 
correctness of quantum theory is dropped, is more de- 
manding, hence the smaller range of e for which free 
randomness amplification is successful. Nevertheless, the 
fact that it is possible at all is already fascinating. 

It is an open question as to how far the threshold on 
e can be pushed such that free randomness amplification 
remains possible (in either scenario). It turns out that 
using chained Bell correlations there is a limit, since (as 
shown in Appendix O for e > | — sa 0.146, these 
correlations admit alocal classical explanation. How- 
ever, we conjecture that other protocols exists that use 
arbitrarily weak randomness to generate virtually perfect 
free randomess. 



Conjecture 1 — There exist alternative protocols such 
that the restriction on e in Theorems 1 and 2 can be 
replaced by e < ^. 

We give some evidence for this in Appendix [H] 
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IV. DISCUSSION 

We now discuss the implications of these results in light 
of previous work, starting with randomness extraction, 
introduced in [T71 [TB] . This is the task of taking a string 
of bits about which there may be some side information 
and using it to generate a string which is uniform even 
given this side information. All previous protocols for 
this task were classical and require an additional uniform 
random seed (i.e. bits which are perfectly free) which acts 
as a catalyst (there have recently been extensions of this 
work to certain imperfect seeds, provided they are un- 
correlated with the string being compressed and that the 
size of the side information is bounded [H]). In the case 
without an independent seed, it has been shown that no 
classical algorithm can extract even a single uniform bit 
from an adversarially controlled string of partially free 
bits [m [20] ■ This shows that free randomness amplifi- 
cation, which we show is possible in this work, cannot 
be done using only classical (deterministic) information 
processing. We give a more detailed discussion in Ap- 
pendix |Dj where we also discuss the connection to inde- 
pendent sources of randomness, such as those in |21| . 

It is worth contrasting randomness amplification, as 
considered here, with randomness expansion, introduced 
in [22] and further developed in [23l [S^ . There, an ini- 
tial perfectly random finite seed is used within a protocol 
to generate a longer sequence of random bits using un- 
trusted devices. In contrast, in the present work we do 
not require such a seed, but instead have an arbitrarily 
large supply of imperfect randomness. 

A potential way to use our protocol is as a method 
for generating a seed, to be used with an extractor to 
extract further randomness from a partially free source, 
or to seed a randomness expansion protocol. Using Tre- 
visan's extractor [25, 26,, for example, in the first case 
we could generate random bits at the entropy rate of the 
partially free source. In the second case, provided that 
the protocols can be securely composed, a secure ran- 
domness expansion protocol may allow a virtually un- 
bounded amount of free randomness to be derived from 
a finite number of uses of partially free sources. 

Our work also connects to the so-called "free will" the- 
orem of Conway and Kochen [371115], which is, in essence, 
a combination of Bell's theorem [4] and the Kochen- 
Specker theorem [29]. Conway and Kochen's notion of 
free will is roughly the same as our definition of free ran- 



domness. Hence, using their language, we could restate 
our main result as a proof that free will can be amplified. 

We also comment on the implications of our result 
for experimental demonstrations of Bell-inequality vio- 
lations. There are several potential loopholes in current 
experiments, leaving the door open for die-hards to reject 
certain philosophical implications. One such loophole, 
which has received only minor attention in the literature, 
is the so called free- choice loophole, which has been ad- 
dressed in a recent experiment |30| . This loophole says 
that the supposedly free measurement settings were in 
fact known beforehand. In the aforementioned experi- 
ment, this is addressed by using random number gener- 
ators, triggered at spacelike separation from the source 
of entangled pairs. However, as acknowledged in [30j . 
this leaves room for what they call "super-determinism" , 
since it is impossible to exclude the possibility that the 
random number generator and the source of entangle- 
ment have interacted in the past. 

Use of our result is also not able to close this loophole, 
and, since we can never rule out that the universe is de- 
terministic, we don't see any way to completely close it. 
Nevertheless, Theorem 2 allows the free choice assump- 
tion to be weakened; Instead of having to assume that 
the entanglement source and the random number gen- 
erator are completely uncorrelated, we would only need 
to assume that they are not strongly correlated. Fur- 
thermore, if Conjecture 1 is correct, it is sufficient that 
they are not completely correlated. We therefore pro- 
pose that, in experiments where the assumption of free 
choice is critical, these choices are generated using our 
free randomness amplification procedure. 
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Appendix A: Correctness vs. completeness of quantum theory 

For a large part of this work, we make the assumption that quantum theory is correct, but not necessarily complete. 
To recap, correctness means that the observed distributions of measurement outcomes will follow those given by 
quantum theory. Completeness is a stronger notion and means that there is no higher theory which better explains 
the outcomes (i.e., a theory that provides us with additional information allowing us to better predict the outcomes 
of measurements). While the correctness assumption is often sufficient, for instance, to predict the behaviour of 
a physical device, there are scenarios in which the additional assumption of completeness is crucial. One example 
is in quantum cryptography, which aims to show that there is no attack within the laws of physics that renders a 
cryptographic scheme insecure. 

The distinction between these two notions is a significant one. Correctness is an operational concept and is in 
principle experimentally verifiable: by repeatedly measuring a system, we can place increasingly accurate bounds on 
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its statistics. Completeness, on the other hand, is not directly verifiable, and many of our experimentally well-founded 
theories have found higher explanation in the past (statistical mechanics explains many phenomena in thermodynamics 
at a higher level, for example). We therefore argue that assuming completeness is a different class of assumption, and 
we do not make it in this work. 

Note that in the second part of our result, we also drop the assumption of correctness, showing that by performing 
measurements (chosen with £-free bits) we can verify the correlations to a sufficient level to conclude that their 
outcomes are random. 



Appendix B: General scenario and notation 



Here we explain the setup of a general protocol for free randomness amplification. Before doing so, we introduce 
some notation. 

A pair of SVs, {A, X) is said to be time-ordered (denoted A X) if the coordinate {t, r) of A lies is the backward 
lightcone of the coordinate {t',r') of X, i.e. if c^(t — i')^ > |r — r'p and t < t' (where c is the speed of light). 
Furthermore, we say that two time-ordered pairs A X and B Y are spacelike separated ii A -/^ Y and B -/^ X. 

We use W to summarize all parameters that a higher theory may provide. Using {Rj} to denote the partially 
free bits, the requirements of Equation ([T]) imply that each bit Rj is e-free with respect to {Rk} U W. In particular, 
PRj\W0j G [| ^ 5 + ^] where 8^ is the set of all bits Rk with time coordinate smaller than that of Rj (with respect 
to some reference frame). 

We consider protocols for this task which involve performing M spacelike separated measurements Ai Xi for 
some M > 2. Each measurement setting, Ai, is derived from a number of bits Rj, and Xi is the corresponding 
outcome. The idea is that, for an appropriate distribution Pxi...Xm\Ai...Am specified by the protocol (and realizable 
using a set of measurements on a quantum system prepared in a certain state), one or more of the output bits Xi, or 
some (possibly random) function of them, is arbitrarily close to being perfectly free. 

We can also recast the setup in an adversarial scenario. Here, the set of variables, W, with which the partially 
free sources may be correlated can be thought of as being held by an adversary. (More generally, one could think 
of a correlated system (instead of the SVs W) which takes an input, corresponding to a choice of measurement, and 
gives an output (analogous to a quantum system). However, both the input and output can be included in the set 
W.) The adversary then supplies an M-party system whose behaviour, Pxi...XM\Ai...AM-wj may depend on W. For 
the first part of our result, we consider the case where the adversary sets up this system such that, if the partially free 
bits are used to choose {Ai}, the resulting distribution (averaged over W) is indistinguishable from that generated by 
performing quantum measurements on a quantum state specified by the amplification protocol. The only restriction 
for the adversary is that the distributions Pxi...XM\Ai...AMW no-signalling. The output of the protocol is then 
considered free if it is uniformly distributed and the adversary is unable to learn anything about it. 



Appendix C: Necessity of the no-signalling conditions 



Here we show that, in order to incorporate perfectly free random bits into a theory, it is necessary that this 
theory satisfies the no-signalling conditions. Note that an Af-party distribution Pxi...Xm\Ai...Am no-signalling if 
Px^\Ai Am ~ for all i, where X:j^ :— Xi . . . Xi^iXi^i . . . Xm- The argument essentially follows one proposed 

in JU] (see also EI]).' 

Lemma — Let Ai and Xi be a set of SVs such that Ai Xi are spacelike separated, where i E {1, . . . , AI}, and let W 
be an arbitrary set of SVs. If, for all i, Ai is perfectly free with respect to W U {Aj,Xj}j, then Pxi...Xm\Ai...Amw is 
no-signalling. 

Proof — Using B ayes' rule we have 



P 



Xj^\Ai...AMW 



= P 



^i\Ai^~ 



A,\AlX^w 
PAi\Alw 



Since, by assumption, Ai is perfectly free with respect to U {Aj,Xj}j, and W , Af- and X;^ are not in the future 
lightcone of Ai, we have Pa^ia^x^w = Pa,\a^w = ^Af It hence follows that Px^\Ai Amw = Px^\A-^w^ i-^- that 
..Xm\Ai...Amw is no signalling. 
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Appendix D: Use of multiple independent sources 

One may wonder whether, given the no-signalhng assumption, the outputs of partiaUy free sources at spaceUke 
separation are necessarily independent of each other. If this was the case, i.e., if the sources were independent, it 
would be possible to generate arbitrarily free bits by a purely classical procedure. More precisely, as shown in [21j . 
two independent sources of e-free bits can be used to generate e'-free ones for any e' > by taking as a final bit the 
number of places in which a sufficiently large number of the outputs are equal modulo 2 (the GF(2) inner-product of 
the output strings). 

In the following, we argue however that the no-signalling assumption does not generally imply that spacelike 
separated sources produce independent outputs. This is easily seen by example. Suppose that the separated sources 
share the quantum state 



il+e) 100) + ^ J - e2 101) + - e) 1 10) + 

and generate their partially free bits by measurement in the {|0) , |1)} basis. The resulting distribution corresponds 
in effect to choosing the bias of the second bit depending on the output of the first. However, by construction, this 
source of randomness is clearly no-signalling (because quantum theory has this property). 

While the classical construction of [3T] is not in general applicable to such correlated sources, our result shows that 
the partially free output of the sources can nevertheless be turned into almost perfectly free uniform randomness. 



Appendix E: Proof of Lemma 1 

We remark that this proof is a generalization of one given in [10] , which in turn was based on a series of work [15l [16] 
going back to the first provably secure device- independent key distribution protocol 1141 . 

Recall that we are working in a bipartite setup where measurements A X and B Y are made at spacelike 
separation, with A € {0, 2, . . . , 27V - 2}, B G {1, 3, . . . , 27V - 1}, X e {+1, -1} and Y e {+1, -1}. We first consider 
the quantity Jjv (defined in Equation ([2|) evaluated for the conditional distribution Pxy\ab,w = Pxy\abw{'j ']'■, w), 
for any fixed w. The idea is to use this quantity to bound the trace distance between the conditional distribution 
Px\aw and its negation, 1 — Px\aw, which corresponds to the distribution of X if its values are interchanged. If this 
distance is small, it follows that the distribution Px\aw is roughly uniform. 

For qq = 0, bo = 2N — 1, we have 

IN{PxY\AB,^.) := PiX = Y\ao,bo, w)+J2 ^ Y\a, b, w) 

a,b 
la-b\ = l 

> D{1 - Px )+ J2 D{Px\abw,PY\abn,) 

a,b 
\a-b\ = l 

= ^(1 ^ Px\aowj PY\bow) + ^ DiPx\aw^ PY\bw) 

a,b 
\a-b\ = l 

> -D(l — Px\aow, Px\aow) 

= 2D{Pxiao^,Px), (El) 

where we have used the no-signalling conditions Px\abw = Px\aw and Pyiabw = PY\bwj the triangle inequality for D 
and the relation D{Px\n, ^V|n) < P{X ^ Y\^) for any event 
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Since the quantity In{Pxy\ab,w) cannot be computed without access to w, we instead consider 
In{Pxy\ab) P{X^Y\ao,bQ 



J2 P^-obo MPiX = Y\aobow) +J2 J2 



a, fa w 



Pwlabjw) 
Pw\aob„(w\ 



■PwiaoboWPiX y^Y\abw) 



aobai"^) 

w |a-6|=l 

Pw\ab{w) 



Pw\ab{w) 



In{Pxy\abw) 



> 2 min 

|a-b| = l 



.^V|aofco(^) 

Using the definition of (/iv(a, b), we have the bound 



.Pw\aoboiw)_ 

D{PxW\aobo,Px X Pw\aobo) ■ 



(E2) 



D{PxW\aobo^Px ^ Pw\aobo) < 



In{Pxy\ab) 



29Ar(ao,6o) 

The proof for arbitrary a and b (rather than a = oq, b = bo) follows by symmetry. 



Appendix F: Proof of Theorem 2 



Note that the bounds used in this section are not tight and one would expect to be able to improve the bound we give 
on e; our aim here is to give a proof-of-principle. The protocol we use for free randomness amplification is in essence 
a one-party version of the Barrett-Hardy-Kent key distribution protocol |14| . The quantum correlations we rely on 

are those formed by measurements on the state ^(|00) + |11)) in the bases {cos |0) + sin |1) , sin |0) — 

cos |1)}, where 0a — ^ and Oi, = f^. Note that although we phrase the protocol in terms of measurements on 
maximally entangled states, we do not have to trust that this is what is actually happening. The protocol is based 
only on the observed correlations. It involves two parameters, M and N, to be determined later. 

1. Take M maximally entangled qubit pairs and isolate each qubit (for example, all of the qubits could be spacelike 
separated) . 

2. For each pair, pick Ag E {0, 2, ... , 2N — 2} randomly using logiV instances from a source of e-free bits, and 
likewise pick Bg E {1,3,..., 2N — 1}. Make the corresponding measurement and record the outcomes {Xg E 
{0,1} andy, E {0,1}). 

3. Collect the choices Ag and Bg and discard all rounds except those for which Ag and Bg were neighbouring. 

4. Collect Xg and Yg for all the remaining pairs (call this set S). If the size of S is not between M /N and M/N^^^, 
abort. 

5. Pick one of the members, /, of S (randomly using an e-free source). 

6. For each member of S, check that Xg — Yg {Xg ^ Yg for Ag = 0, Bg — 2N — 1). If this condition does not hold 
for any q, then abort. 

7. Use Xf as the final free bit. 

We sketch the proof that this protocol is secure. We say that the protocol fails if the marginal distribution 
PxfYf\AfBfw on round / has lN{PxfYf\AfBfw) > fo'" some positive real number I'^, to be specified later, and it 
doesn't abort. The idea is to show that the protocol fails with low probability, i.e. for any non-signalling distribution 
with a significant probability that lN{PxfYj\AjBjw) > there is a high probability of the protocol aborting in 
Stepje] 

For each marginal distribution with /^v > /^vj the worst case, there is one pair [A,B) that could potentially 
lead to detection (the resulting detection probability is then at least /^), and this pair is chosen with probability 
(1/2 — £)^'°s^^ por simplicity, we use that the other neighbouring pairs are each chosen with probability at most 
(l/2-He)2i°g^. 
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There are at least M/N neighbouring pairs (otherwise the protocol aborts). From the set of neighbours, e-free 
bits are used to pick the final outcome. The most probable choice occurs with probability (1/2 + e)i°g(WJV) = 
{M/Ny°sii/2+e)^ gQ ^j^g typical set has at least {M/N)-^°sii/-2+e) members. 

A significant fraction of this typical set must have In > 1^ for the protocol to fail. For each member of the 
typical set with In > 1^^ the probability that it is measured using the (A,B) pair that enables detection is at least 

6 



(1/2 — 6)'^ log N 

2jV(i/2+£)^'°8" ■ average number of times that the condition in Step 



does not hold thus scales as 
(A'f/iV)"'°s(^/^+^^7V"^"^'°s(^/^+^)+^'°s(i/2-^)/^ 



(recall that if this condition does not hold, the protocol aborts). 

If we choose M = N^/^ and 1*^^ = N''^/'^ and substitute into the above, we get 7V-7/2i°g(V2+e)+2iog(i/2-e)-5/4^ 
whose exponent is positive for e < 0.0158, and hence this value grows with N for small enough e. Note that, since 



the value of In can be made arbitrarily small, it follows using the relation (El) (which, by symmetry holds with oq 
replaced by arbitrary a) that e' can also be made arbitrarily small. 

Note also that quantum correlations can achieve a value of In that scales like 1/A^, so that, with the above choice 
of M, the average number of detections in the case with perfect quantum states scales like N^^/"^, which tends to 
for large N . Thus, the protocol will almost never abort if correctly implemented with quantum states. 



Appendix G: Limitation of using chained Bell correlations 



In the following we show that, using the above approach based on chained Bell correlations, the threshold on e 
in Theorem 1 cannot be made arbitrarily small. To do so, we prove that if e is above a certain value, then these 
correlations admit a classical explanation. 

We first note that a classical strategy can always appear to satisfy the correlations (lead to a measured value of 
In = 0) if one pair of A, B values present in the definition of In is known not to occur. Furthermore, using the best 
possible classical strategy, for each W — w, either P{X = Y\aQ, bo, w) or one of {P{X ^ Y\a, b, w)}|a-fc|=i will equal 1 
and all the others will be 0. Therefore, the optimal classical strategy involves a setup in which the term that equals 
1 corresponds to the pair (a, b) with the minimum probability of occurring, which can be set using W. For N — 2^ , 
we have minj, ^ P45|^,(a, 6) = (| — and we assume the minimal pair is chosen uniformly over the pairs (a, 6) in 
In (this makes it easiest to recreate the correlations using a classical strategy, i.e., in a cryptographic picture, it gives 
the greatest power to the adversary). We hence have 

P{X^Y\a,b) = '^P{X ^Y,W ^w\a,b) 

W 

= P{W = {a,b)\a,b) 

P{W = ia,b))P{a,b\W ^ {a,b)) 
" P{a,b) 

2-2- 1^2 V 

for (a, b) ^ (ao, bo), and the same value is obtained for P{X = Y\ao, bo). (Here W = (a, b) indicates the pair of a and 
b values that are least likely to occur.) The value of I-z^ that would be observed is then (1 — 2£)2''. 
In order to be consistent with quantum theory, this should be at most 2^'^^ sin^ 5^^' 

- £ < ^ 2 sin^ -— r 
2 ~ \/2 V 2'-+2y 

This function is decreasing in r, so, in order to achieve arbitrarily free output bits with the largest e, we should use 

1 

the largest possible r. For large r, the right hand side approaches (^) ' f^™*^^' the limit r — > 00, consistency 

with quantum theory is achievable for e > ^ — sa 0.146. 

The above places limitations on when free randomness amplification is possible using chained Bell correlations (we 
cannot expect to improve the quality of bits from sources of e-free bits with e > 0.146, using these correlations). 
Note that related limitations on using bipartite correlations (in the context of demonstrating non-locality) have been 
reached in other recent work [SHE]. 
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Appendix H: Possible route to proving Conjecture 1 

We hint that one may be able to estabhsh the truth of Conjecture 1 usmg GHZ states (S^- That GHZ correlations 
may be more useful for this task comes from the following observations about GHZ correlations: for any < e < ^, 
e-free bits are sufficient to demonstrate non-locality for these correlations (in contrast to the bipartite case, whose 
limitations were described above). We first outline a few important properties of these correlations. 

For M parties, GHZ correlations are those generated by measuring each part of the state ^ (|0 . . . 0) — |1 . . . 1)) in 

either the {!+),, I-) J or J basis (where |±), = ^(|0)±|1)) and |±)^ = ^(|0) ±i |1))). For convenience, 

we denote the inputs corresponding to these bases and 1 respectively. These correlations have the property that 
certain output combinations are impossible. For example, if M — 3 and all three parties input the product of the 
outcomes is always —1. We now consider a classical strategy, which corresponds to an assignment of outputs to each 
input (this assignment may depend on some additional SVs, W). We label the bits assigned to the ith output by 
e ±1 and xj G ±1, where the superscript refers to the possible inputs Ai — or Ai — 1. 

In order to mimic the quantum correlations, the classical output bits need to satisfy x^x^x'^ = —1, Xixlxl = 1, 
x\x2xl = 1 and cc^ccjXg = 1. It is easy to see that this is impossible (for example, taking the product of all three 
equations yields (x^ 3)^ = —1). However, there are classical strategies which satisfy 3 of these relations (for 

example, when each output is 1, independent of its input). 

We now imagine choosing measurements to perform on tripartite GHZ states using bits that are e-free. As mentioned 
above, for any classical strategy, there is at least one combination of inputs that yields an incorrect set of outputs. 
Using the e-free source of randomness in three places, the probability of such an input is (| — e)^. Hence, for any 
e < |, the presence of a classical strategy will eventually be noticed as more tests are performed. We conclude that 
non- locality can be verified with e-frec bits provided e < | (i.e. the bits are not completely correlated with W). 

Nevertheless, it does not follow that the outputs of such measurements are completely free, and, in fact, it is easy 
to see that they may not be. One set of no-signalling correlations that satisfy all the GHZ relations is realized by 
having a deterministic output (conditioned on W) for one of the parties, and a non-local box [321 IS] shared between 
the remaining two [35 . Using these correlations, there is always one output that is deterministic and hence not free 
and random. 

However, we suggest that arbitrarily free bits may be generated from partially free ones using an M-party GHZ 
state for large M. The partially free source of randomness is used in M places to choose measurements on each part 
of the state in either of the two bases specified above. Then, if the outputs satisfy the M-party GHZ relations, one 
of the randomness sources is used to pick one of the M output bits at random. The idea is that, in the limit of large 
M, this output is arbitrarily close to being perfectly free, except with very small probability. However, it may turn 
out that other states and measurements are required in order to prove Conjecture 1. 

A corollary of the above is that if the measurement devices are restricted to be quantum (rather than arbitrary 
no-signalling, i.e. we trust that the measurement devices are limited by quantum theory, but not what they are doing 
internally) , e-free bits for any < e < | can be used to generate arbitrarily free bits. This follows from the observation 
that the only quantum states that perfectly obey the tripartite GHZ relations are (up to local unitary operations) 
GHZ states [211121], from which perfect randomness can be derived by taking any of the three outputs. Hence, a 
set of quantum measurement devices that never deviate from the GHZ relations (using measurements chosen with an 
e-free source) also generate perfectly free randomness. 



